The remote host is running a version of Mozilla SeaMonkey earlier than 1.1.17. Such versions are reportedly affected by multiple vulnerabilities : 

  - Multiple remote memory-corruption vulnerabilities.

  - Content injection vulnerabilities.

  - An information disclosure vulnerability.

  - A cross-site scripting vulnerability.

  - A privilege escalation vulnerability.

  - A security bypass vulnerability.

  - A URI spoofing vulnerability.

The installed version of Firefox is earlier than 3.0.11. Such versions are potentially affected by the following security issues : 

  - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-24)

  - Certain invalid Unicode characters, when used as a part of IDN, can be displayed as a whitespace in the location bar. An attacker can exploit this vulnerability to spoof the location bar. (MFSA 2009-25)

  - It may be possible for local resources loaded via 'file: ' protocol to access any domain's cookies saved on a user's system. (MFSA 2009-26)

  - It may be possible to tamper with SSL date via non-200 responses to proxy CONNECT requests. (MFSA 2009-27)

  - A race condition exists in 'NPObjWrapper_NewResolve' when accessing the properties of a NPObject, a wrapped JSObject. (MFSA 2009-28)

  - If the owner document of an element becomes a null after garbage collection, then it may be possible to execute the event listeners within the wrong JavaScript context. An attacker can potentially exploit this vulnerability to execute arbitrary JavaScript with chrome privileges. (MFSA 2009-29)

  - When the 'file: ' resource is loaded from the location bar, the resource inherits principal of the previously loaded document. This could potentially allow unauthorized access to local files. (MFSA-2009-30)

  - While loading external scripts into XUL documents content-loading policies are not checked. (MFSA 2009-31)

  - It may also be possible for scripts from page content to run with elevated privileges. (MFSA 2009-32)

The installed version of Thunderbird is earlier than 2.0.0.22. Such versions are potentially affected by the following security issues :

  - Multiple remote memory corruption vulnerabilities exist which can be exploited to execute arbitrary code in the context of the user running the affected application. (MFSA 2009-14)

  - A flaw may exist where Unicode box drawing characters are allowed in Internationalized Domain Names where they could be visually confused with punctuation used in valid web addresses. An attacker can leverage this to launch a phishing-type scam against a victim. (MFSA 2009-15)

  - A vulnerability exists when the 'jar:' scheme is used to wrap a URI which serves the content with 'Content-Disposition: attachment'. An attacker can leverage this to subvert sites which use this mechanism to mitigate content injection attacks. (MFSA 2009-16)

  - When an Adobe Flash file is loaded via the 'view-source:' scheme, the Flash plugin misinterprets the origin of the content as localhost. An attacker can leverage this to launch cross-site request forger attacks. It is also possible to exploit this to place cookie-like objects on victim's computers. (MFSA 2009-17)

  - A vulnerability exists which allows attackers to inject arbitrary scripts into sites via XBL bindings. This vulnerability requires the attacker to have the ability to embed third-party stylesheets into the site. (MFSA 2009-18)

  - Multiple remote code execution vulnerabilities exist caused by the creation of documents whose URI does not match the document's principle using XMLHttpRequest, as well as a flaw in the 'XPCNativeWrapper.ToString' '__proto__' coming from the wrong scope. (MFSA 2009-19)

  - A malicious MozSearch plugin could be created using a javascript: URI in the SearchForm value. An attacker can leverage this in order to inject code into arbitrary sites. (MFSA 2009-20)

  - An information disclosure vulnerability exists when saving the inner frame of a web page as a file when the outer page has POST data associated with it. (MFSA 2009-21)

  - A cross site scripting vulnerability exists when handling a Refresh header containing a javascript: URI. (MFSA 2009-22)" );

ID	名称	产品	系列	严重程度
801255	Mozilla SeaMonkey < 1.1.17 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800755	Firefox < 3.0.11 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801249	Mozilla Thunderbird < 2.0.0.21 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high

检测

插件搜索

high

high

high